terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/snowflake/delphi/databases/orchard-fansifter/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

provider "snowflake" {
  account_name = var.account
  role         = "PROD_ATLANTIS"
}

resource "snowflake_shared_database" "database_from_share" {
  name       = var.database_name
  from_share = "SME.AUTO_FULFILLMENT_AREA$PUBLIC_AWS_US_EAST_1.FANSIFTER_SNOWFLAKE_SECURE_SHARE_1732194621969"
}

resource "snowflake_account_role" "read_role" {
  name    = "${var.database_name}_DB_READ"
  comment = "Managed by Terraform"
}

resource "snowflake_grant_ownership" "grant_ownership_to_useradmin" {
  account_role_name = "USERADMIN"
  on {
    object_type = "ROLE"
    object_name = snowflake_account_role.read_role.name
  }
}

resource "snowflake_grant_account_role" "grant_role_to_sysadmin" {
  role_name        = snowflake_account_role.read_role.name
  parent_role_name = "SYSADMIN"
}

resource "snowflake_grant_privileges_to_account_role" "read_role_grant" {
  account_role_name = snowflake_account_role.read_role.name
  privileges        = ["IMPORTED PRIVILEGES"]
  on_account_object {
    object_type = "DATABASE"
    object_name = snowflake_shared_database.database_from_share.name
  }
}